fix(oauth2): Add missing urlencode for failure redirection

come-nc · backportbot[bot] · commit f25bb40dd0e9 · 2026-04-21T09:04:43.000Z
Signed-off-by: Côme Chilliet &lt;come.chilliet@nextcloud.com&gt;
diff --git a/apps/oauth2/lib/Controller/LoginRedirectorController.php b/apps/oauth2/lib/Controller/LoginRedirectorController.php
@@ -81,7 +81,7 @@ public function authorize($client_id,
 
 		if ($response_type !== 'code') {
 			//Fail
-			$url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . $state;
+			$url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . \urlencode($state);
 			return new RedirectResponse($url);
 		}
 

Original file line number	Diff line number	Diff line change
`@@ -81,7 +81,7 @@ public function authorize($client_id,`
`81`	`81`
`82`	`82`	`if ($response_type !== 'code') {`
`83`	`83`	`//Fail`
`84`		`- $url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . $state;`
	`84`	`+ $url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . \urlencode($state);`
`85`	`85`	`return new RedirectResponse($url);`
`86`	`86`	`}`
`87`	`87`